Systems and methods for automated network state and network inventory tracking

ABSTRACT

A network state tracking system tracks the state of a network and recommends an action when the state of the network changes. The network state tracking system detects one or more nodes on the network and generates one or more snapshots of the network. The snapshots are generated by obtaining first and second status data from the nodes and detecting whether a change in the network has occurred based on the status data. The snapshots are generated based on the first and second status data when a change in the network is detected. The snapshots are then used to train a machine learning model to recommend an action to take when a change in the network occurs.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of priority to U.S. application Ser.No. 17/158,988, filed Jan. 26, 2021, which is hereby incorporated byreference in its entirety.

In cases where the present application conflicts with a documentincorporated by reference, the present application controls.

BRIEF SUMMARY

A network inventory refers to a repository storing data regarding alluser devices, virtual machines, network infrastructure devices, softwareprograms, resource pools, clusters, etc., (collectively referred as“nodes”) which are connected to a computer network. Informationtechnology (IT) specialists and network engineers routinely use datastored in a network inventory. However, because of the dynamic nature ofnetwork inventories, IT specialists and network engineers are unable toanalyze the data stored in a network inventory to inform their decisionsregarding the network. Additionally, while logs from nodes can beanalyzed, the significance of such events can only be understood in thecontext of the entire network state at the time the log was generated,and traditional methods are unable to provide such a context.Furthermore, they do not have adequate tools to recommend actions totake when a change in the network inventory occurs.

The embodiments disclosed herein address the issues above and thus helpsolve the above technical problems and improve the technology of networkstate and network inventory tracking by providing a technical solutionthat collects data from a multitude of nodes connected to a network andusing that data to train a machine learning model which recommends andaction to take when the state of the network changes. Additionally, theembodiments disclosed herein are further able to be integrated in placeof, or in conjunction with, network infrastructure devices and software,such as devices, software, and container-orchestration systems forcomputer application scaling, deployment, and management. Furthermore,the embodiments disclosed herein are further able to be scaled up ordown to accommodate large network infrastructures, such as a nationwidenetwork, to small network infrastructures, such as a home network.

In some embodiments a network state tracking system detects one or morenodes on a computer network, generates snapshots of the networkincluding status data related to the nodes, and trains a machinelearning model to suggest an action to take based on a determinationthat the network state has changed. In some embodiments, the networkstate tracking system receives status data from a node, determineswhether the network state has changed based on the status data, andtransmits an action to take to the node based on a determination thatthe network state has changed. In some embodiments, the network statetracking system includes a network state tracking data structure whichcan be used to train a machine learning model to predict an action totake when a change in the network state occurs.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

FIG. 1 is a display diagram showing an example network in which thenetwork state tracking system operates, according to various embodimentsdescribed herein.

FIG. 2 is a block diagram depicting example components incorporated in anetwork state tracking system, according to various embodimentsdescribed herein.

FIG. 3 is a block diagram depicting an example data lake, which may beincluded in an inventory storage device according to various embodimentsdescribed herein.

FIG. 4a is a display diagram depicting a network state tracking systeminteracting with network management infrastructure through a stateinformation database according to various embodiments described herein.

FIG. 4b is a display diagram depicting a network state tracking systeminteracting with network management infrastructure through a nodeinstantiation system according to various embodiments described herein.

FIG. 4c is a display diagram depicting a network state tracking systeminteracting with network management infrastructure through both a nodeinstantiation system and a state information database according tovarious embodiments described herein.

FIG. 4d is a display diagram depicting a network state tracking systeminteracting with network management infrastructure through a nodeinstantiation system according to various embodiments described herein.

FIG. 5 is a display diagram depicting a distributed network statetracking system according to various embodiments described herein.

FIG. 6 is a flow diagram depicting a process for generating snapshots ofa network based on status data, according to various embodimentsdescribe herein.

FIG. 7 is a flow diagram depicting a process for training a machinelearning model to recommend an action to take based on generatedsnapshots, according to various embodiments described herein.

FIG. 8 is a flow diagram depicting a process for obtaining an indicationof an action to take from a network state tracking system, according tovarious embodiments described herein.

FIG. 9 is a flow diagram depicting a process to use a network statetracking data structure to train a machine learning model to determinean action to take when a change in the network state is detected,according to various embodiments described herein.

DETAILED DESCRIPTION

Network engineers and IT specialists (collectively “users”) generallywork with network inventories and use these inventories to assist insolving problems with the network, such as connection issues, bandwidthissues, etc., in the development of software or hardware which accessesthe network, or in diagnosing or fixing issues with nodes. It iscurrently difficult for users to diagnose network issues and to keeptrack of changes in the network state. Furthermore, it is difficult forusers to determine an action to take when a change in the network stateoccurs. It is also difficult to understand why an action had been takenin the past given that the network state has changed since.

The embodiments disclosed herein address the issues above and help solvethe above technical problems and improve the technology of networkstate, network configuration, and network inventory tracking byproviding a technical solution that collects data from a multitude ofnodes connected to a network and using that data to train a machinelearning model which recommends and action to take when the state of thenetwork changes. A network state tracking system additionally uses anetwork inventory to store data and track the network state. The networkstate tracking system uses the stored data to train a machine learningmodel to suggest an action to take when the network state trackingsystem detects a change in the network state. The machine learning modelis thereby trained to interpret the changes to individual nodes in thecontext of the overall network state, and make a more informedsuggestion of an action to take. In some embodiments, the machinelearning model is trained to suggest actions for other scenarios, suchas: the demand on the network; preventing failures in the network;proposing configuration changes to the network, such as for enhancingperformance, optimizing utilization, etc.; scheduling operations on thenetwork; etc.

In some embodiments, the network state tracking system provides thetraining data to an external training system. The network state trackingsystem may use the data to train an artificial intelligence or machinelearning model (an “AI/ML model”) that will be deployed to an externalartificial intelligence engine. The AI/ML model may by operated on adevice or system external to the network state tracking system. Thenetwork state tracking system may use the data, perform the training,and obtain an inference of an action to take. In embodiments where thenetwork state tracking system utilizes or interfaces with an externalmodel, the network state tracking system may provide data related to thecurrent or historical status of the network to the external model. Thenetwork state tracking system may perform different combinations ofthose embodiments (e.g. train some models and provide data to externalsystems which will train other models, which may include externalmodels)).

In some embodiments the network state tracking system detects one ormore nodes in a network, generates one or more snapshots of the network,then trains a machine learning model to recommend an action to takebased on the snapshots of the network. The network state tracking systemmay obtain status data from the nodes of the network. The network statetracking system may utilize the status data to create snapshots of thenetwork. The network state tracking system may utilize the snapshots todetermine whether there was a change in the network state. The networkstate tracking system may detect whether there was a change in thenetwork state based on the status data. The network state trackingsystem may generate a snapshot when a change in the network state isdetected.

In some embodiments, status data is obtained from a node when the nodeconnects to the network. The status data may be obtained from logsgenerated by the node. The status data may include configuration data ofthe node. The status data may include information about how a collectionof nodes is structured and organized.

In some embodiments, the network state tracking system periodicallyreceives additional status data from one or more nodes. The additionalstatus data may be used to generate an additional snapshot of thenetwork. The network state tracking system may use the additionalsnapshot as input for the machine learning model to obtain an action totake.

In some embodiments, the network state tracking system obtains statusdata from nodes and generates snapshots periodically. The network statetracking system may receive a request to generate snapshots from anexternal system. The network state tracking system may determine whetherthere are any differences between a generated snapshot and a previoussnapshot. The network state tracking system may store the differencesbetween the generated snapshot and the previous snapshot. The networkstate tracking system may store the differences between the generatedsnapshot and previous snapshot, without storing the generated snapshot.When the network state tracking system stores the differences betweenthe generated snapshot and the previous snapshot instead of the entiresnapshot, the network state tracking system is able to reduce the amountof memory used to store snapshots by storing only the differencesbetween snapshots rather than complete snapshots. The network statetracking system may use the differences between snapshots and a firstsnapshot to create a log of the history of changes in the network state.

In some embodiments, the network state tracking system stores thesnapshots in a data lake. The network state tracking system may storedifferences between snapshots within a data lake. The network statetracking system may include inventory storage devices. The inventorystorage devices may be used to store data obtained from or related tonodes.

In some embodiments, a node transmits status data representing itsstatus to the network tracking system. The node may transmit the statusdata to the network tracking system multiple times over a period oftime. The node may transmit the status data periodically. The node mayobtain in indication of an action to take from the network trackingsystem.

In some embodiments, a node transmits status data based on adetermination that it has connected to a network which is being trackedby the network state tracking system. The node may generate a logincluding status data, such as configuration information and stateinformation, for the node. The node may transmit the log to the networkstate tracking system. The node may transmit status data to an inventorystorage device. The node may obtain configuration data, and apply theconfiguration data to the node. A node may transmit status orconfiguration data on behalf of or about another node (e.g. an ElementManagement System may transmit information about the element it manages,an orchestration system may transmit information about how it structuresthe nodes it orchestrates or about a new virtual machine it justcreated). The configuration data may be obtained from the network statetracking system.

In some embodiments, the network state tracking system utilizes anetwork state tracking data structure. The network state tracking datastructure may be used to store information regarding nodes, includinginformation related to the status of a node. The network state trackingdata structure may also include information related to networksnapshots. The network state tracking system may use the network statetracking data structure to determine whether the state of the networkhas changed. The network state tracking system may utilize the networkstate tracking data structure to train a machine learning model todetermine an action to take when a change in the state of the network isdetected. At least a portion of the network state tracking datastructure may be stored within an inventory storage device. The networkstate tracking data structure may include configuration data for one ormore of the nodes.

In some embodiments, the network state tracking data structure storesdifferences between network snapshots. The differences between networksnapshots may be used in conjunction with a network snapshot toreconstruct the state of the network at any time after, or before, thenetwork snapshot was taken. The network snapshots may includeconfigurations for each node, or for the network as a whole, and may beused to track changes in the configurations over time.

In some embodiments, the network state tracking data structure includesinformation specifying one or more sub-networks included within anetwork. The network state tracking system may associate eachsub-network with its own network state tracking data structure. Thenetwork state tracking system may use data from each sub-network totrain a machine learning model to suggest an action to take for thenetwork. The network state tracking system may use data from eachsub-network to train a machine learning model to suggest an action totake for a sub-network when a change in the state of the sub-network isdetected.

In some embodiments, the network state tracking system detects whether achange in the network state was a positive change or a negative change.A positive change may include, but is not limited to raising, enhancing,or otherwise improving network resources. A negative change may include,but is not limited to, lowering, degrading, or otherwise reducingnetwork resources. Positive or negative changes in a network may includemore than the improvement or reduction of network resources. The networkstate tracking system may obtain user input indicating whether a changewas positive or negative. The network state tracking system may inferwhether an action was taken based, at least in part, on one or more of:what device caused the change in the network state, whether the changewas positive or negative, and the status data before and after thechange occurred.

Unless the context requires otherwise, throughout the specification andclaims which follow, the word “comprise” and variations thereof, suchas, “comprises” and “comprising” are to be construed in an open,inclusive sense, for example “including, but not limited to.”

Reference throughout this specification to “one embodiment” or “anembodiment” means that a particular feature, structure or characteristicdescribed in connection with the embodiment is included in at least oneembodiment. Thus, the appearances of the phrases “in one embodiment” or“in an embodiment” in various places throughout this specification arenot necessarily all referring to the same embodiment. Furthermore, theparticular features, structures, or characteristics may be combined inany suitable manner in one or more embodiments.

As used in this specification and the appended claims, the singularforms “a,” “an,” and “the” include plural referents unless the contentclearly dictates otherwise. The term “or” is generally employed in itssense including “and/or” unless the content clearly dictates otherwise.

The headings and Abstract of the Disclosure provided herein are forconvenience only and do not interpret the scope or meaning of theembodiments.

FIG. 1 is a display diagram showing an example network 100 in which thenetwork state tracking system operates, according to various embodimentsdescribed herein. It is to be appreciated that FIG. 1 illustrates justone example of a network in which a network state tracking systemoperates, and that various embodiments discussed herein are not limitedto the use of such an environment. The network 100 includes a networkstate tracking system 101, one or more nodes 103 a-103 c, and aninventory storage device 105. The inventory storage device 105 furtherincludes a data lake 300 which is further described in relation to FIG.3 below.

The network 100 is a network, communication system, or networked system(not shown), to which the network state tracking system 101, as well asnodes 103 a-103 c and other endpoint devices (not shown), and theinventory storage device 105 may be coupled. Non-limiting examples ofsuch a network or communication system include, but are not limited to,an Ethernet system, twisted pair Ethernet system, an intranet, a localarea network (“LAN”) system, short range wireless network (e.g.,Bluetooth®), a personal area network (e.g., a Zigbee network based onthe IEEE 802.15.4 specification), a Consumer Electronics Control (CEC)communication system, Wi-Fi, satellite communication systems andnetworks, cellular networks, cable networks, or the like. One or moreendpoint devices, such as PCs, tablets, laptop computers, smartphones,personal assistants, Internet connection devices, wireless LAN, WiFi,Worldwide Interoperability for Microwave Access (“WiMax”) devices, orthe like, may be communicatively coupled to the network and/or to eachother so that the plurality of endpoint devices are communicativelycoupled together. Thus, such a network enables the network statetracking system 101, nodes 103 a-103 c, the inventory storage device 105and any other interconnected endpoint devices, to communicate with eachother.

The nodes 103 a-103 c may include devices such as routers, switches,route reflectors, firewalls, proxies, load balancers, Cell towers,antennas, Radio Access equipment, Core network equipment, contentdistribution equipment, orchestration systems, network managementsystems, network assurance systems, servers, storage equipment,transmission equipment, data center equipment, road side units, cellulartelephones, smartphones, tablets, personal computers, laptop computers,wireless peripheral devices such as headphones, microphones, mice,keyboards, etc., security cameras, Internet of Things (or “smart”)devices, televisions, smart televisions, smart television devices,routers, digital assistants, personal assistant devices, virtualmachines, network infrastructure devices, etc. The nodes 103 a-103 c mayinterconnect to one or more communications media or sources, such asrouters, network switches, modems, etc., to transmit communications toother devices. The nodes 103 a-103 c may transmit data representingtheir status, configuration, and network statistics, such as timeconnected, bandwidth, upload and/or download speed, etc., to the networkstate tracking system 101.

The above description of the network 100, and the various devicestherein, is intended as a broad, non-limiting overview of an exampleenvironment in which various embodiments of a network state trackingsystem 101 can operate. The network 100, and the various devicestherein, may contain other devices, systems and/or media notspecifically described herein.

Example embodiments described herein provide applications, tools, datastructures and other support to implement systems and methods formanaging the state of a network. The example embodiments describedherein additionally provide applications, tools, data structures andother support to implement systems and methods for providing determiningwhether a change has occurred on a computer network, as well as whatcaused the change to occur. Other embodiments of the describedtechniques may be used for other purposes, including for training amachine learning model to generate an action to take when a change inthe network state is detected. In the description provided herein,numerous specific details are set forth in order to provide a thoroughunderstanding of the described techniques. The embodiments describedalso can be practiced without some of the specific details describedherein, or with other specific details, such as changes with respect tothe ordering of processes or devices, different processes or devices,and the like. Thus, the scope of the techniques and/or functionsdescribed are not limited by the particular order, selection, ordecomposition of steps described with reference to any particularmodule, component, or routine.

FIG. 2 is a block diagram depicting example components incorporated in anetwork state tracking system 101, according to various embodimentsdescribed herein. In various embodiments, the network state trackingsystem 101 includes one or more of the following: a computer memory 201for storing programs and data while they are being used, including dataassociated with the nodes 103 a-103 c, inventory storage device 105, andthe network state tracking system 101, an operating system including akernel, and device drivers; a central processing unit (“CPU”) 202 forexecuting computer programs; a persistent storage device 203, such as ahard drive or flash drive for persistently storing programs and data;and a network connection 204 for connecting to one or more nodes, suchas nodes 103 a-103 c and/or other computer systems, connecting to one ormore inventory storage devices 105, to send and/or receive data, such asvia the Internet or another network and associated networking hardware,such as switches, routers, repeaters, electrical cables and opticalfibers, light emitters and receivers, radio transmitters and receivers,and the like, and to scan for and retrieve signals from nodes 103 a-103c, inventory storage devices 105, and/or other endpoint devices. Invarious embodiments, the network state tracking system 101 additionallyincludes input and output devices, such as a keyboard, a mouse, displaydevices, etc.

While a network state tracking system 101 configured as described may beused in some embodiments, in various other embodiments, the networkstate tracking system may be implemented using devices of various typesand configurations, and having various components. The memory 201 mayinclude a network state tracking controller 210 which containscomputer-executable instructions that, when executed by the CPU 202,cause the network state tracking system 101 to perform the operationsand functions described herein. For example, the programs referencedabove, which may be stored in computer memory 201, may include or becomprised of such computer-executable instructions. The memory 201 mayalso include a network state machine learning model 212 which is trainedto suggest an action to take when a change in the state of a network isdetected. In some embodiments, the network state machine learning model212 is trained to perform other functions, such as: to predict demand onthe network; predict failures in the network; propose configurationchanges to the network, such as for enhancing performance, optimizingutilization, etc.; to schedule operations on the network; etc. In someembodiments, the network state tracking system 101 includes multiplenetwork state machine learning models 212. In such embodiments, themultiple network state machine learning models 212 may perform differentfunctions. The memory 201 may also include data regarding a currentnetwork status 214, which includes data describing the current status ofnodes on the network. The memory 201 may also include a historicalnetwork status 216, which includes data describing the status of nodeson the network in the past. The current network status 214 andhistorical network status 216 may be used to train the network statemachine learning model 212 and detect whether a change in the networkhas occurred. In some embodiments, current network status 214 andhistorical network status 216 may be used to train the network statemachine learning model 212 to predict demand on the network; predictfailures in the network; propose configuration changes to the network,such as for enhancing performance, optimizing utilization, etc.; toschedule operations on the network; etc.

The network state tracking controller 210 and network state machinelearning model 212 perform the core functions of the network statetracking system 101, as discussed herein and also with respect to FIGS.4 through 9. In particular, the state tracking controller 210 obtainsstatus data from nodes 103 a-103 c, and uses the status data todetermine whether a change in the network state has occurred and totrain a network state machine learning model 212 to recommend an actionto take based on a determination that the network state has changed oris likely to change. The network state tracking controller 210 mayadditionally include instructions to transmit an indication of aconfiguration file for a node 103 a-103 c, based on the recommendedaction received from the machine learning model 212. The network statetracking controller 210 may additionally contain computer-executableinstructions to cause the server to perform some or all of theoperations further described in FIGS. 4-9. The network state trackingcontroller 210 may additionally contain computer-executable instructionsto implement the network state machine learning model 212 as anartificial neural network, machine learning, and/or other artificialintelligence components to determine an a recommended action to takewhen a change in the network state is detected, or to determine whethera change in the network state has occurred. In some embodiments, thefunctions of the network state machine learning model 212 areimplemented through other computer automation tools or techniques, suchas by using a rules-engine. The functions of the network state machinelearning model 212 may also be implemented by using a combination ofmachine learning and a rules-engine. The network state machine learningmodel 212 may be implemented outside of the network state trackingsystem 101. The network state machine learning model 212 may include anAPI to communicate with the network state tracking system 101, as wellas to obtain the current status 214 and historical status 216. The statetracking controller 210 may also include computer-executableinstructions for receiving input related to node configurations, nodesettings, optimal network benchmarks, network status goals, etc. Forexample, the artificial intelligence components of the system mayreceive in real time digital signals indicative of the status of variousnodes as the state of each individual node changes, and create snapshotsof the network as the status of each of the nodes is received. Thesnapshots can then be used to train the network state machine learningmodel 212 to recommend an action to take when a change in the networksstate has occurred. The accuracy of such recommendations may be providedin a feedback loop to artificial intelligence components such that theartificial intelligence components may learn which digital signalsindicative of what types of changes in the network status necessitate anaction to be taken.

The current network status 214 and historical network status 216 includedata from nodes describing the current network status and historicalnetwork status respectively. The data describing the network status maybe in the form of snapshots of the network generated by the networkstate tracking controller 210 based on data obtained from nodes 103a-103 c. The data describing the network status may be comprised ofchanges to the network status over time, such that it can be used toreconstruct the state of the network at any time which the network statetracking controller has network status data. The current network status214 and historical network status 216 may be stored in an inventorystorage device 105, for example, in a data lake, such as the data lake300, in addition to, or instead of, being stored along with the networkstate tracking system.

In an example embodiment, the network state tracking controller 210and/or computer-executable instructions stored on memory 201 of thenetwork state tracking system 101 are implemented using standardprogramming techniques. For example, the network state trackingcontroller 210 and/or computer-executable instructions stored on memory201 of the network state tracking system 101 may be implemented as a“native” executable running on CPU 202, along with one or more static ordynamic libraries. In other embodiments, the network state trackingcontroller 210 and/or computer-executable instructions stored on memory201 of the network state tracking system 101 may be implemented asinstructions processed by a virtual machine that executes as some otherprogram.

The embodiments described above may also use synchronous or asynchronousclient-server computing techniques. However, the various components maybe implemented using more monolithic programming techniques as well, forexample, as an executable running on a single CPU computer system, oralternatively decomposed using a variety of structuring techniques knownin the art, including but not limited to, multiprogramming,multithreading, client-server, or peer-to-peer, running on one or morecomputer systems each having one or more CPUs. Some embodiments mayexecute concurrently and asynchronously, and communicate using messagepassing techniques. Equivalent synchronous embodiments are alsosupported. Also, other functions could be implemented and/or performedby each component/module, and in different orders, and by differentcomponents/modules, yet still achieve the functions of the networksstate tracking system 100.

In addition, programming interfaces to the data stored as part of thenetwork state tracking controller 210, current network status 214, andhistorical network status 216 can be available by standard mechanismssuch as through C, C++, C#, and Java APIs; libraries for accessingfiles, databases, or other data repositories; through scriptinglanguages such as JavaScript and VBScript; or through Web servers, FTPservers, or other types of servers providing access to stored data. Thenetwork state tracking controller 210, current network status 214, andhistorical network status 216 may be implemented by using one or moredatabase systems, file systems, or any other technique for storing suchinformation, or any combination of the above, including implementationsusing distributed computing techniques.

Different configurations and locations of programs and data arecontemplated for use with techniques described herein. A variety ofdistributed computing techniques are appropriate for implementing thecomponents of the embodiments in a distributed manner including but notlimited to TCP/IP sockets, RPC, RMI, HTTP, Web Services (XML-RPC,JAX-RPC, SOAP, and the like). Other variations are possible. Also, otherfunctionality could be provided by each component/module, or existingfunctionality could be distributed amongst the components/modules indifferent ways, yet still achieve the functions of the network statetracking system 101, nodes 103 a-103 c, and/or the inventory storagedevice 105.

Furthermore, in some embodiments, some or all of the components/portionsof the network state tracking controller 210, network state machinelearning model 212, and/or functionality provided by thecomputer-executable instructions stored on memory 201 of the networkstate tracking system 101 may be implemented or provided in othermanners, such as at least partially in firmware and/or hardware,including, but not limited to, one or more application-specificintegrated circuits (“ASICs”), standard integrated circuits, controllers(e.g., by executing appropriate instructions, and includingmicrocontrollers and/or embedded controllers), field-programmable gatearrays (“FPGAs”), complex programmable logic devices (“CPLDs”), and thelike. Some or all of the system components and/or data structures mayalso be stored as contents (e.g., as executable or othermachine-readable software instructions or structured data) on acomputer-readable medium (e.g., as a hard disk; a memory; a computernetwork or cellular wireless network; or a portable media article to beread by an appropriate drive or via an appropriate connection, such as aDVD or flash memory device) so as to enable or configure thecomputer-readable medium and/or one or more associated computing systemsor devices to execute or otherwise use or provide the contents toperform at least some of the described techniques. Such computer programproducts may also take other forms in other embodiments. Accordingly,embodiments of this disclosure may be practiced with other computersystem configurations.

In general, a range of programming languages may be employed forimplementing any of the functionality of the servers, nodes, etc.,present in the example embodiments, including representativeimplementations of various programming language paradigms and platforms,including but not limited to, object-oriented (e.g., Java, C++, C#,Visual Basic.NET, Smalltalk, and the like), functional (e.g., ML, Lisp,Scheme, and the like), procedural (e.g., C, Pascal, Ada, Modula, and thelike), scripting (e.g., Perl, Ruby, PUP, Python, JavaScript, VBScript,and the like) and declarative (e.g., SQL, Prolog, and the like).

FIG. 3 is a block diagram depicting an example data lake 300, which maybe included in an inventory storage device 105 according to variousembodiments described herein. The data lake 300 includes a historicalinventory 301, a historical configuration 303, and a historical state305. The historical inventory 301 is used to store logs 312 andsnapshots 314 related to the inventory of the network, thereby allowinga network storage device to easily access the repository containing logsand snapshots describing the nodes currently connected to, or which havebeen at some point connected to, the network. The historicalconfiguration 303 operates in a similar manner to the historicalinventory 301, except the historical configuration 303 is used to storelogs 332 and snapshots 334 describing the configuration of nodes whichare connected to, or have been connected to, the network. The historicalconfiguration 303 is thus able to store data indicating theconfiguration of any node at any time for which a snapshot was taken.The historical state 305 operates in a similar manner to the historicalinventory 301 and historical configuration 303, except the historicalstate 305 is used to store logs 352 and snapshots 354 describing thestate of the network at various times. The data lake 300 may beimplemented by using one or more inventory storage devices 105.

FIGS. 4a-4d each depict example embodiments of a network state trackingsystem interacting with current network management infrastructure, suchas a container-orchestration system, e.g. Kubernetes. Each of theembodiments of FIGS. 4a-4d depict different manners of incorporating anetwork state tracking system by utilizing existing network managementinfrastructure, thereby saving time, development resources, andcomputing resources by efficiently communicating with existinginfrastructures.

FIG. 4a is a display diagram depicting a network state tracking systeminteracting with network management infrastructure through a stateinformation database according to various embodiments described herein.In FIG. 4a , the network state tracking system 101 communicates with astate information database 403, which in turn communicates with a nodeinstantiation system 405. The node instantiation system 405 is used tocreate and manage nodes. In some embodiments, the node instantiationsystem 405 utilizes a container-orchestration system, such asKubernetes. The state information database 403 is used to collect stateand status information regarding nodes managed by the node instantiationsystem 405. In some embodiments, the state information database 403utilizes a key-value storage system, such as etcd, to store the stateand status information. In FIG. 4a the network state tracking system 101communicates with the state information database 403, such as via anAPI, to obtain state and status information regarding the nodes.

FIG. 4b is a display diagram depicting a network state tracking systeminteracting with network management infrastructure through a nodeinstantiation system according to various embodiments described herein.In FIG. 4b , the network state tracking system 101 communicates with thenode instantiation system 415, which in turn communicates with a stateinformation database 413. In such embodiments, the node instantiationsystem 415 provides data to the network state tracking system 101regarding each node and each node's status.

FIG. 4c is a display diagram depicting a network state tracking systeminteracting with network management infrastructure through both a nodeinstantiation system and a state information database according tovarious embodiments described herein. In FIG. 4c , the network statetracking system 101 communicates with the node instantiation system 425by using the API of the state information database 423. For example, ifthe state information database 423 utilizes etcd, the network statetracking system 101 would utilize the etcd API to communicate with thenode instantiation system 425. The network state tracking system 101additionally periodically syncs its data with the state informationdatabase 423 to ensure that it has the correct status data for eachnode. In such embodiments, the network state tracking system 101 is ableto obtain and verify node status data without changing any of theexisting network infrastructure.

FIG. 4d is a display diagram depicting a network state tracking systeminteracting with network management infrastructure through a nodeinstantiation system according to various embodiments described herein.In FIG. 4d , the network state tracking system 101 communicates directlywith the node instantiation system 435 and replaces a state informationdatabase. In such embodiments, the network state tracking system 101additionally performs the operations of the state information database,and communicates with the node instantiation system 435 by using an APIfamiliar to the node instantiation system 435, such as an etcd API.

FIG. 5 is a display diagram depicting a distributed network statetracking system according to various embodiments described herein. Insome embodiments, the distributed network state tracking systeminfrastructure is used to operate the network state tracking system overlarge areas by utilizing “child” network state tracking systems torepresent different areas. The distributed network state tracking systemincludes a main network state tracking system 501 which communicateswith two “child” network state tracking system: a west network statetracking system 511 and an east network state tracking system 521. Thewest network state tracking system 511 communicates with three “child”network state tracking systems: a west core network state trackingsystem 513, a west transport network state tracking system 515, and awest RAN network state tracking system 517. The east network statetracking system 521 communicates with three “child” network statetracking systems: an east core network state tracking system 523, aneast transport network state tracking system 525, and an east RANnetwork state tracking system 527. The child network state trackingsystems each collect data to create snapshots, detect when the state oftheir network, or portion of a network, has changed, and to train amachine learning model to recommend an action to take in response to achange in the state of the network. The “parent” network state trackingsystem obtains data from each of its child network state trackingsystems to: create snapshots of the network, detect changes in the stateof the network, and train a machine learning model to recommend anaction to take in response to a change in the state of the network.

In some embodiments, the parent network state tracking system and childnetwork state tracking systems each recommend actions based on differentchanges in a network's state. For example, the West Transport NetworkState Tracking system 515 may detect that a node has gone offline, andrecommend and action in response to detecting the node which has goneoffline. However, the Main Network State Tracking system 501 would notrecommend an action for the node which has gone offline. Likewise, theMain Network State Tracking system may detect that a large portion ofnodes in the East Network State Tracking system 521 have gone offlineand would recommend an action to take in response to detecting that thelarge portion of nodes are offline. In some embodiments, the recommendedaction may include taking a corrective action, informing a system thatis capable of taking a corrective action, informing operators capable oftaking a corrective action, etc.

FIG. 6 is a flow diagram depicting a process for generating snapshots ofa network based on status data, according to various embodimentsdescribed herein. At act 601, the network state tracking system obtainsfirst status data for one or more nodes connected to the network. At act603, the network state tracking system obtains second status data forthe one or more connected to the network at a later time. At act 605,the network state tracking system detects whether a change in thenetwork state has occurred based on a comparison of the first statusdata and the second status data. In some embodiments, a change in thenetwork state includes: changes in the status of one or more nodes, suchas bandwidth usage of a node, connection strength of a node,configuration of a node, etc., the addition of new nodes to the network,the removal of nodes from the network, etc. At act 607, the networkstate tracking system generates a snapshot of the network based on thefirst status data and the second status data. In some embodiments, thesnapshot includes information describing the status data for each of theone or more nodes connected to the network. The information includedwithin the snapshot may be used to represent the state of the network ata specified moment in time.

In some embodiments, the network state tracking system generates a“partial snapshot” by storing the differences, or incremental changes,between the current network state and the network state of a previouslygenerated snapshot to generate the snapshot of the network instead ofgenerating a complete snapshot of the network. The partial snapshot ofthe network may include only the differences between the current networkstate and the network state of the previously generated snapshot.Additionally, the partial snapshot of the network may include more thanonly the differences between the current network state and the networkstate of the previously generated snapshot, such as additional dataregarding one or more specified nodes, logs for one or more specifiednodes, configuration data for one or more nodes, etc. In suchembodiments, the network state tracking system is able to reconstructthe network at certain moments in time by applying the differencesindicated by the partial snapshots to a previously generated completesnapshot.

In some embodiments, the network state tracking system obtains statusdata when a node is connected to, or loses its connection to, thenetwork. The status data may include data obtained from logs generatedby a node. The status data may include configuration data of a node. Thenetwork state tracking system may obtain the status data periodically.The network state tracking system may generate network state snapshotsperiodically. In some embodiments, the network state tracking systemonly generates network state snapshots periodically, instead of when achange in the network state is detected. The network state trackingsystem may generate network state snapshots both periodically and when achange in the network state is detected. In some embodiments, thenetwork state tracking system receives an indication to generate anetwork snapshot. The indication to generate a network snapshot may beobtained via user input, from another computer system, etc.

The network state tracking system may obtain status data from nodes, orgenerate a snapshot, based on a multitude of detected events, including,but not limited to: instantiation events triggered by an orchestrationsystem; network expansion events, such as adding a new node or newnetwork infrastructure (such as a networking devices, cell towers,repeaters, etc.); “life cycle” events reported by an orchestrator, suchas the transition of a node from an idle state to an in-service state;“failure events” such as when a line is cut, a piece of the networkinfrastructure is inoperable, etc.; and changes in configurations, suchas adding a new VLAN to the network to handle high priority traffic,opening an interface to a new Data Network, rearranging systems tore-balance traffic load, etc.

FIG. 7 is a flow diagram depicting a process for training a machinelearning model to recommend an action to take based on generatedsnapshots, according to various embodiments described herein. At act701, the network state tracking system detects one or more nodesconnected to the network. At act 703, the network state tracking systemdetects whether a change in the network state has occurred. In someembodiments, act 703 is performed in a similar manner to act 605 of FIG.6. At act 705, the network state tracking system generates a snapshot ofthe network when a change in the network has occurred. In someembodiments, act 705 is performed in a similar manner to act 607 of FIG.6.

At act 707, the network state tracking system stores the snapshot of thenetwork in an inventory storage devices, along with additional snapshotsof the network. In some embodiments, the snapshots are stored within adata lake. At act 709, the network state tracking system trains amachine learning model to recommend an action to take based on thestored snapshots. In some embodiments, act 709 is performed for eachsnapshot obtained. In some embodiments, act 709 is performedperiodically, such as every minute, hourly, weekly, monthly, etc., andthe machine learning model is trained based on a plurality of networksnapshots gathered over a period of time.

In some embodiments, acts 705-707 are performed periodically, such asevery microsecond, every second, every minute, hourly, daily, weekly,etc., regardless of whether a change is detected in the network state.The captured snapshots may then be used to determine whether a change inthe network has occurred.

In some embodiments, the machine learning model is trained to performother functions, such as: to predict demand on the network; to predictfailures in the network; to propose configuration changes to thenetwork, such as for enhancing performance, optimizing utilization,etc.; to schedule operations on the network; etc. In some embodiments,the snapshots may be used to train multiple machine learning models.

In some embodiments, the network state tracking system identifiesactions to take based on one or more of: the detected changes in thenetwork state and logs obtained for each node. The network statetracking system may identify an action to take by identifying a changein the network state between two snapshots and classifying that changeas an action. For example, the network state tracking system may detectthat a change has occurred where a node has lost its connection, andthen another change has occurred where the node is brought back onlineby restarting the node. The network state tracking system may thenidentify that restarting the node is an action taken after the node lostits connection based on the changes in the network state or based onlogs obtained from the node. The action may include one or more of, butare not limited to: adjusting one or more configurations for a node,pushing an old configuration to a node, restarting a node, taking a nodeoffline, adding a new node, doing nothing, etc. The network statetracking system may perform the action itself without user interaction,such as by transmitting an indication of an action to take to a specificnode. The network state tracking system may transmit an indication ofthe action to take to a network manager.

In some embodiments, the network state tracking system additionallyidentifies whether a “positive outcome” has occurred after a change innetwork state, and may attribute that positive outcome to an actionwhich changed the network state. For example, the network state trackingsystem may detect that a change has occurred, where a certain group ofnodes experience bandwidth issues after a node is added to the group.The network state tracking system may then detect that the bandwidthissues, by analyzing logs and/or the status of nodes in the group, havebeen reduced when a switch was added to the group of nodes. The networkstate tracking system would identify the reduction of bandwidth issuesas a “positive outcome” and identify the action to be adding a switch tothe group of nodes to help regulate the network bandwidth. The networktracking system may perform similarly to detect whether a “negativeoutcome” has occurred after a change in the network state, and mayattribute that negative outcome to an action which changed the networkstate. In some embodiments, determining whether a negative outcome hasoccurred allows the network state tracking system to train a machinelearning model to predict which change caused a change in the networkstate.

FIG. 8 is a flow diagram depicting a process for obtaining an indicationof an action to take from a network state tracking system, according tovarious embodiments described herein. At act 801, a node obtains firststatus data describing the network status of the computing device. Thestatus data may include configuration data. The status data may includedata obtained from logs generated by the computing device. The node maytransmit status data to the network state tracking system afterdetecting that it has connected to a network. At act 803, the nodetransmits the first status data to a network state tracking system. Atact 805, the node obtains second status data at a later time, in asimilar manner to act 801. At act 807, the node transmits the secondstatus data to the network state tracking system. At act 809, the nodeobtains an indication of an action to take from the network statetracking system. In some embodiments, the action may include one or moreof, but is not limited to: changing a configuration of the node,restarting the node, taking the node offline, bringing another nodeeither online or offline, etc. In some embodiments, at act 809, theindication of an action to take is obtained from one or more machinelearning models in a network state tracking system. The indication of anaction to take may be obtained from a combination of one or more machinelearning models and one or more rules. The one or more rules may bestored by the network state tracking system, the node, or anotherdevice.

FIG. 9 is a flow diagram depicting a process to use a network statetracking data structure to train a machine learning model to determinean action to take when a change in the network state is detected,according to various embodiments described herein. At act 901, thenetwork state tracking data structure obtains information specifying oneor more nodes. At act 903, the network state tracking data structureobtains information specifying first status data for at least a portionof the one or more nodes. At act 905, the network state tracking datastructure obtains information specifying second status data for thenodes. At act 907, the networks state tracking data structure obtainsinformation specifying one or more network snapshots. The informationspecifying one or more network snapshots may be obtained from a networkstate tracking system. At act 909, the information stored in the networkstate tracking data structure is used to determine whether a change inthe network state has occurred, such as by determining whether there aredifferences between a current snapshot and a previous snapshot of thenetwork state. At act 911, the information stored in network statetracking data structure is used to train a machine learning model todetermine an action to take when a change in the state of the network isdetected. In some embodiments, the network state tracking data structureis stored in an inventory storage device. The network state trackingdata structure may be stored in a data lake. In some embodiments, thenetwork state tracking data structure stores configuration data for atleast one of the nodes.

In some embodiments, the machine learning model is trained to performother functions, such as: to predict demand on the network; to predictfailures in the network; to propose configuration changes to thenetwork, such as for enhancing performance, optimizing utilization,etc.; to schedule operations on the network; etc. In some embodiments,the network state tracking data structure may be used to train multiplemachine learning models.

In some embodiments, the network state tracking data structure storesadditional data describing the network snapshots. The network state datastructure may store data describing a time that a network snapshot wastaken. The network state tracking data structure may store thedifferences between a network snapshot and a snapshot taken before orafter the network snapshot.

In some embodiments, the network state tracking data structure storesinformation specifying one or more sub-networks (or “child” networks)included within the network. Each of the sub-networks may include theirown network state tracking data structure. The network state trackingdata structure may also include information one or more “parent”networks which the network state tracking data structure is included in.

The various embodiments described above can be combined to providefurther embodiments. All of the U.S. patents, U.S. patent applicationpublications, U.S. patent applications, foreign patents, foreign patentapplications and non-patent publications referred to in thisspecification and/or listed in the Application Data Sheet areincorporated herein by reference, in their entirety. Aspects of theembodiments can be modified, if necessary to employ concepts of thevarious patents, applications and publications to provide yet furtherembodiments.

These and other changes can be made to the embodiments in light of theabove-detailed description. In general, in the following claims, theterms used should not be construed to limit the claims to the specificembodiments disclosed in the specification and the claims, but should beconstrued to include all possible embodiments along with the full scopeof equivalents to which such claims are entitled. Accordingly, theclaims are not limited by the disclosure.

1-20. (canceled)
 21. A system, comprising: at least one processor; andat least one memory coupled to the at least one processor, the memoryhaving computer-executable instructions stored thereon that, whenexecuted by the at least one processor, cause the system to:electronically detect one or more nodes of a network; electronicallydetect a change in the network, wherein the change in the network isdetected by: electronically obtaining first status data for each node ofthe one or more nodes; electronically obtaining second status data foreach node of the one or more nodes; and electronically detecting whethera change in a state of the network has occurred based on at least thefirst status data and the second status data; and based on one or moresnapshots of the network, at least one reconstructed prior state of thenetwork, and one or more other detected changes in the network,electronically determine a recommended action to take in response to thedetected change.
 22. The system of claim 21, wherein to electronicallydetermine the recommended action, the computer-executable instructionsfurther cause the system to: electronically apply the detected change inthe network to a machine learning model trained to generate arecommended action based on at least: one or more snapshots of thenetwork, at least one reconstructed prior state of the network, and oneor more other detected changes in the network; and electronically causeat least one node of the one or more nodes to take the recommendedaction.
 23. The system of claim 22, wherein the computer-executableinstructions, when executed by the at least one processor, further causethe system to: electronically reconstruct a representation of the stateof the network at a previous time based on at least the one or moresnapshots of the network.
 24. The system of claim 22, wherein thecomputer-executable instructions, when executed by the at least oneprocessor, further cause the system to: electronically generate at leasta portion of the one or more snapshots of the network based on at leastthe first status data, the second status data, and the detection ofwhether a change in the state of the network has occurred.
 25. Thesystem of claim 24, wherein the computer-executable instructions, whenexecuted by the at least one processor, further cause the system to:electronically reconstruct a representation of the state of the networkat the current time based on the at least one or more snapshots of thenetwork; and electronically supplement the training of the machinelearning model by using at least the generated recommended action, thefirst status data, the second status data, the one or more snapshots,and the reconstructed representation of the state of the network. 26.The system of claim 21, wherein the computer-executable instructions,when executed by the at least one processor, further cause the systemto: electronically determine, based on the first status data, the secondstatus data, and the detected change in the network state, whether thechange in the network state is a positive change or a negative change;and based on one or more snapshots of the network, at least onereconstructed prior state of the network, and one or more other detectedchanges in the network, electronically determine a recommended action totake in response to the detected change and the determination of whetherthe change is a positive change or a negative change.
 27. The system ofclaim 21, wherein the recommended action includes one or more of: aprediction of the demand on the network at a future time; a predictionof whether one or more failures will occur in at least one node of theone or more nodes at a future time; a suggested change in aconfiguration of at least one node of the one or more nodes; a suggestedchange in a configuration of the network; a suggested time to scheduleone or more network operations; and a suggested time to schedulemaintenance for at least one node of the one or more nodes.
 28. Thesystem of claim 21, wherein the computer-executable instructions, whenexecuted by the at least one processor, further cause the system to:electronically cause the recommended action to be applied to at leastone node of the one or more nodes.
 29. One or more storage devicescollectively storing a network state tracking data structure for accessand processing by a program executed by at least one computer processorthat, when accessed and processed by at least one computer processor,functionally enables the computer processor to: determine an action totake based on a current state of a network, the network state trackingdata structure comprising: information specifying one or more nodes;information specifying first status data obtained from the one or morenodes; information specifying second status data obtained from the oneor more nodes; information specifying the one or more network snapshots;and information specifying a reconstructed prior state of the network,such that the information specifying first status data and theinformation specifying the second status data are usable to determinewhether a change has occurred in the state of the network, such that thedetected change, the information specifying one or more snapshots, andthe information specifying the prior state of the network are usable todetermine a recommended action to take in response to the detectedchange.
 30. The one or more storage device of claim 29, the networkstate tracking data structure further comprising: information specifyinga machine learning model trained to generate a recommended action basedon at least: one or more network snapshots, at least one reconstructedprior state of the network, and one or more other detected changes inthe network, such that the recommended action is able to be applied tothe one or more nodes.
 31. The one or more storage device of claim 30,the network state tracking data structure further enabling the computerprocessor to: reconstruct a representation of the state of the networkat the current time based on the information specifying one or morenetwork snapshots, the information specifying the first status data, andthe information specifying the second status data; and supplement thetraining of the machine learning model by using the reconstructedrepresentation of the state of the network at the current time,information specifying one or more network snapshots, the informationspecifying the first status data, the information specifying the secondstatus data, and the generated recommended action.
 32. The one or morestorage device of claim 29, the network state tracking data structurefurther enabling the computer processor to: cause the generatedrecommended action to be applied to at least one node of the one or morenodes.
 33. The one or more storage device of claim 29, further enablingthe computer processor to: determine whether the change in the networkstate is a positive change or a negative change based on one or more of:the information specifying the first status data, the informationspecifying the second status data, and the determined change, such thatthe recommended action is generated based on detected change, theinformation specifying one or more snapshots, the information specifyingthe prior state of the network, and the determination of whether thechange is a positive change or a negative change.
 34. A method in anetwork state tracking system, the method comprising: detecting one ormore nodes of a network; detecting a change in the network, wherein thechange in the network is detected by: obtaining first status data foreach node of the one or more nodes; obtaining second status data foreach node of the one or more nodes; and detecting whether a change in astate of the network has occurred based on at least the first statusdata and the second status data; and based on one or more snapshots ofthe network, at least one reconstructed prior state of the network, andone or more other detected changes in the network, determining arecommended action to take in response to the detected change. 35.method system of claim 34, wherein determining the recommended actionfurther comprises: applying the detected change in the network to amachine learning model trained to generate a recommended action based onat least: one or more snapshots of the network, at least onereconstructed prior state of the network, and one or more other detectedchanges in the network; and causing at least one node of the one or morenodes to take the recommended action.
 36. The method of claim 35, themethod further comprising: reconstructing a representation of the stateof the network at a previous time based on at least the one or moresnapshots of the network.
 37. The method of claim 35, the method furthercomprising: generating at least a portion of the one or more snapshotsof the network based on at least the first status data, the secondstatus data, and the detection of whether a change in the state of thenetwork has occurred.
 38. The method of 37, the method furthercomprising: reconstructing a representation of the state of the networkat the current time based on the at least one or more snapshots of thenetwork; and supplementing the training of the machine learning model byusing at least the generated recommended action, the first status data,the second status data, the one or more snapshots, and the reconstructedrepresentation of the state of the network.
 39. The method of claim 34,the method further comprising: determining, based on the first statusdata, the second status data, and the detected change in the networkstate, whether the change in the network state is a positive change or anegative change; and based on one or more snapshots of the network, atleast one reconstructed prior state of the network, and one or moreother detected changes in the network, determining a recommended actionto take in response to the detected change and the determination ofwhether the change is a positive change or a negative change.
 40. Themethod of claim 34, the method further comprising: causing therecommended action to be applied to at least one node of the one or morenodes.